Refactor PropertyTreeState to use RefPtrs

third_party/WebKit/Source/core/paint/ObjectPaintProperties.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ObjectPaintProperties_h
 #define ObjectPaintProperties_h
 
 #include "core/CoreExport.h"
 #include "platform/geometry/LayoutPoint.h"
 #include "platform/graphics/paint/ClipPaintPropertyNode.h"
 #include "platform/graphics/paint/EffectPaintPropertyNode.h"
 #include "platform/graphics/paint/GeometryPropertyTreeState.h"
 #include "platform/graphics/paint/PaintChunkProperties.h"
 #include "platform/graphics/paint/ScrollPaintPropertyNode.h"
 #include "platform/graphics/paint/TransformPaintPropertyNode.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/RefPtr.h"
 #include <memory>
 
 namespace blink {
 
 // A complete set of paint properties including those that are inherited from other objects.
-struct PropertyTreeState {
-    PropertyTreeState(const TransformPaintPropertyNode* transformState,
-        const ClipPaintPropertyNode* clipState, const EffectPaintPropertyNode* effectState,
-        const ScrollPaintPropertyNode* scrollState)
-        : transform(transformState), clip(clipState), effect(effectState), scroll(scrollState)
+// RefPtrs are used to guard against use-after-free bugs and DCHECKs ensure PropertyTreeState never
+// retains the last reference to a property tree node.
+class PropertyTreeState {
+public:
+    PropertyTreeState(const TransformPaintPropertyNode* transform,
+        const ClipPaintPropertyNode* clip,
+        const EffectPaintPropertyNode* effect,
+        const ScrollPaintPropertyNode* scroll)
+        : m_transform(transform), m_clip(clip), m_effect(effect), m_scroll(scroll)
     {
-        DCHECK(transform && clip && effect && scroll);
+        DCHECK(!m_transform->hasOneRef() && !m_clip->hasOneRef() && !m_effect->hasOneRef() && !m_scroll->hasOneRef());
     }
-    const TransformPaintPropertyNode* transform;
-    const ClipPaintPropertyNode* clip;
-    const EffectPaintPropertyNode* effect;
-    const ScrollPaintPropertyNode* scroll;
+
+    const TransformPaintPropertyNode* transform() const { DCHECK(!m_transform->hasOneRef()); return m_transform.get(); }
+    const ClipPaintPropertyNode* clip() const { DCHECK(!m_clip->hasOneRef()); return m_clip.get(); }
+    const EffectPaintPropertyNode* effect() const { DCHECK(!m_effect->hasOneRef()); return m_effect.get(); }
+    const ScrollPaintPropertyNode* scroll() const { DCHECK(!m_scroll->hasOneRef()); return m_scroll.get(); }
+
+private:
+    RefPtr<const TransformPaintPropertyNode> m_transform;
+    RefPtr<const ClipPaintPropertyNode> m_clip;
+    RefPtr<const EffectPaintPropertyNode> m_effect;
+    RefPtr<const ScrollPaintPropertyNode> m_scroll;
 };
 
 // This class stores property tree related information associated with a LayoutObject.
 // Currently there are two groups of information:
 // 1. The set of property nodes created locally by this LayoutObject.
 // 2. [Optional] A suite of property nodes (PaintChunkProperties) and paint offset
 //    that can be used to paint the border box of this LayoutObject.
 class CORE_EXPORT ObjectPaintProperties {
     WTF_MAKE_NONCOPYABLE(ObjectPaintProperties);
     USING_FAST_MALLOC(ObjectPaintProperties);
@@ skipping 119 matching lines @@
     RefPtr<TransformPaintPropertyNode> m_scrollTranslation;
     RefPtr<TransformPaintPropertyNode> m_scrollbarPaintOffset;
     RefPtr<ScrollPaintPropertyNode> m_scroll;
 
     std::unique_ptr<LocalBorderBoxProperties> m_localBorderBoxProperties;
 };
 
 } // namespace blink
 
 #endif // ObjectPaintProperties_h